{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "keep-as-periodic-hunt", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The UAC-0099 to Sandworm handover is a documented precursor to destructive attacks; verifying the absence of the MythicRatatoskr backdoor is an essential preventive measure for high-risk estates." }, "name": "MythicRatatoskr Mesh-Network Backdoor and Sandworm Handover", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1053.005", "attack.t1059.001", "attack.t1071", "attack.t1041", "command and control", "impact", "initial access", "persistence" ], "series": { "slug": "mythicratatoskr-an-yggdrasil-enabled-backdoor-deployed-in-a-uac-0099-sandworm-collaboration", "index": 1, "title": "MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration", "total": 2 }, "related": [ { "hunt": "gpo-coordinated-data-wipe", "reason": "This hunt focuses on the persistent backdoor phase; the final wiping phase via GPO is a distinct follow-on activity.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A single detection rule cannot correlate the two-month progression from a phishing-driven scheduled task to a decentralized Go-based mesh backdoor. This hunt baseline-counts the unique IPv6 range and pivots through the earlier MATCHWOK infection markers to verify a complex, multi-actor intrusion.", "coverage": [ { "stage": "initial-access-scheduled-task", "steps": [ "scoping-pdfopentask", "phishing-script-blocks" ], "status": "covered" }, { "stage": "matchwok-backdoor-persistence", "steps": [ "matchwok-registry-persistence" ], "status": "covered" }, { "stage": "mythicratatoskr-service-installation", "steps": [ "mythic-binary-execution" ], "status": "covered" }, { "stage": "yggdrasil-mesh-and-lateral-movement", "steps": [ "yggdrasil-traffic-baseline", "manual-incident-review" ], "status": "covered" }, { "stage": "gpo-coordinated-data-wipe", "reason": "Belongs to another part of the 'MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Initial Access and Scheduled Task Execution", "slug": "initial-access-scheduled-task", "tactic": "initial-access", "techniques": [ "T1566", "T1053.005", "T1059.001" ], "observables": [ "scheduled task named pdfopentask", "PowerShell payload executed from %temp%\\temporarydoc.txt", "MATCHBOIL downloader execution" ] }, { "name": "MATCHWOK Backdoor Persistence", "slug": "matchwok-backdoor-persistence", "tactic": "persistence", "techniques": [ "T1071" ], "observables": [ "registry value UpdateMonitor in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", "C&C domain uztickets.com", "Download URL egyptanimals.com/animals/photoalbum" ] }, { "name": "MythicRatatoskr Service Installation", "slug": "mythicratatoskr-service-installation", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "Windows service named ieupdate", "Binary paths including C:\\windows\\system32\\updater.exe, windowsdefendersvc.exe, and krbtman.exe", "Configuration files named .updatecache in C:\\Windows\\system32 or C:\\Windows\\Temp", "Configuration file .crond in %LocalAppData%/Temp" ] }, { "name": "Yggdrasil Mesh Network C2 and Lateral Movement", "slug": "yggdrasil-mesh-and-lateral-movement", "tactic": "command-and-control", "techniques": [ "T1071", "T1041" ], "observables": [ "IPv6 overlay traffic in the 200::/7 range", "10-minute startup delay for backdoor execution", "SOCKS5 server deployment (krbtman.exe)", "OpenSSH SFTP server used for internal sample distribution" ] }, { "name": "GPO Coordinated Data Wipe", "slug": "gpo-coordinated-data-wipe", "tactic": "impact", "techniques": [ "T1059.001" ], "observables": [ "Active Directory Group Policy (GPO) deployment of wiping tools", "Execution of SDelete utility across the organization" ] } ], "summary": "UAC-0099 initiated access to a Ukrainian firm via spearphishing and deployed the MATCHWOK backdoor before handing off access to Sandworm. The campaign featured a novel Go-based backdoor named MythicRatatoskr that utilizes the Yggdrasil mesh network for command and control, ultimately concluding with a destructive data-wiping attack via Active Directory Group Policy." }, "severity": "high", "rationale": "Focus the hunt on the pdfopentask scheduled task; hosts identified here should be used to seed the scope_hosts parameter for the binary execution phase.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary has established initial access via a scheduled task to deploy the MATCHWOK backdoor and subsequently installed the MythicRatatoskr backdoor, which uses the Yggdrasil mesh network for stealthy C2 communication.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Hosts identified in the scoping step to focus the follow-on binary search." }, "lookback_days": { "type": "number", "default": "60", "description": "Days of history to examine, covering the window from initial access to the reported data-wiping attacks." }, "mythic_binaries": { "from": { "ref": "eset-mythicratatoskr", "kind": "article", "observed": "2026-10-22" }, "type": "list[path]", "default": [ "updater.exe", "krbtman.exe", "windowsdefendersvc.exe", "onedriveliveupdater.exe", "applicationasphost.exe", "act64.exe", "ieupdate.exe", "ie.exe" ], "description": "Binary filenames associated with MythicRatatoskr and its proxy components." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/", "name": "ESET Research \u2014 MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration" } ], "blind_spots": [ { "id": "limited-mesh-visibility", "risk": "Adversaries could maintain C2 via encrypted IPv6 mesh routing that bypasses legacy IPv4-centric network filters.", "stage": "yggdrasil-mesh-and-lateral-movement", "question": "Whether the mesh-network traffic was visible to the network sensors", "requires": "Comprehensive IPv6 logging including deprecated 200::/7 ranges" } ] }, "name": "MythicRatatoskr Mesh-Network Backdoor and Sandworm Handover", "description": "The adversary gains initial access via phishing and persists using scheduled tasks and registry keys. The hunt identifies these early access markers and then pivots to find specialized mesh-network C2 telemetry. The phased flow ensures that the hunt weighs early access markers alongside specialized mesh C2 telemetry to confirm a high-confidence intrusion before the adversary transitions to data-wiping activity." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "mythicratatoskr-an-yggdrasil-enabled-backdoor-deployed-in-a-uac-0099-sandworm-collaboration", "index": 1, "title": "MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration", "total": 2 }, "coverage": [ { "stage": "initial-access-scheduled-task", "steps": [ "scoping-pdfopentask", "phishing-script-blocks" ], "status": "covered" }, { "stage": "matchwok-backdoor-persistence", "steps": [ "matchwok-registry-persistence" ], "status": "covered" }, { "stage": "mythicratatoskr-service-installation", "steps": [ "mythic-binary-execution" ], "status": "covered" }, { "stage": "yggdrasil-mesh-and-lateral-movement", "steps": [ "yggdrasil-traffic-baseline", "manual-incident-review" ], "status": "covered" }, { "stage": "gpo-coordinated-data-wipe", "reason": "Belongs to another part of the 'MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration' series.", "status": "out_of_scope" } ], "rationale": "An adversary has established initial access via a scheduled task to deploy the MATCHWOK backdoor and subsequently installed the MythicRatatoskr backdoor, which uses the Yggdrasil mesh network for stealthy C2 communication.", "blind_spots": [ { "id": "limited-mesh-visibility", "risk": "Adversaries could maintain C2 via encrypted IPv6 mesh routing that bypasses legacy IPv4-centric network filters.", "stage": "yggdrasil-mesh-and-lateral-movement", "question": "Whether the mesh-network traffic was visible to the network sensors", "requires": "Comprehensive IPv6 logging including deprecated 200::/7 ranges" } ], "scoping_notes": "Focus the hunt on the pdfopentask scheduled task; hosts identified here should be used to seed the scope_hosts parameter for the binary execution phase.", "beyond_detection": "A single detection rule cannot correlate the two-month progression from a phishing-driven scheduled task to a decentralized Go-based mesh backdoor. This hunt baseline-counts the unique IPv6 range and pivots through the earlier MATCHWOK infection markers to verify a complex, multi-actor intrusion." } }, { "id": "scoping-pdfopentask", "type": "query", "label": "Scoping the pdfopentask beachhead", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE LOWER(job_name) = 'pdfopentask' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_scheduled_job", "description": "Identify the initial set of hosts where the UAC-0099 execution chain likely began.", "expected_signal": "A list of hosts that executed the reported initial-access task name. Silence implies the beachhead was not established or the task name was rotated." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scoping the pdfopentask beachhead", "reads": [ "device_hostname", "job_name", "job_cmd_line", "job_user_name", "time" ], "source": "hb_scheduled_job", "target": "endpoint", "content": "SELECT device_hostname, job_name, job_cmd_line, job_user_name, time FROM hb_scheduled_job WHERE LOWER(job_name) = 'pdfopentask' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts that executed the reported initial-access task name. Silence implies the beachhead was not established or the task name was rotated.", "verified": "dry-run", "verified_at": "2026-10-24" } }, { "id": "phishing-script-blocks", "type": "query", "label": "PowerShell blocks for temporarydoc.txt", "config": { "dsl": "sqlite", "role": "enrichment", "source": "endpoint", "content": "SELECT device_hostname, script_content, script_path, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%temporarydoc.txt%' OR LOWER(script_content) LIKE '%egyptanimals.com%') AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_script_activity", "description": "Identify the execution of the PowerShell payload from the temporary directory.", "expected_signal": "Script content showing the download or execution of the MATCHBOIL payload." }, "parents": [ { "id": "scoping-pdfopentask" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "PowerShell blocks for temporarydoc.txt", "reads": [ "device_hostname", "script_content", "script_path", "time" ], "source": "hb_script_activity", "target": "endpoint", "content": "SELECT device_hostname, script_content, script_path, time FROM hb_script_activity WHERE (LOWER(script_content) LIKE '%temporarydoc.txt%' OR LOWER(script_content) LIKE '%egyptanimals.com%') AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Script content showing the download or execution of the MATCHBOIL payload.", "verified": "dry-run", "verified_at": "2026-10-24" } }, { "id": "matchwok-registry-persistence", "type": "query", "label": "MATCHWOK Run-key persistence", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\\\currentversion\\\\run\\\\updatemonitor' AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_registry_activity", "description": "Find the specific registry key used to persist the MATCHWOK backdoor.", "expected_signal": "A registry value named UpdateMonitor pointing to a suspicious binary." }, "parents": [ { "id": "scoping-pdfopentask" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "MATCHWOK Run-key persistence", "reads": [ "device_hostname", "reg_target", "reg_value_data", "time" ], "source": "hb_registry_activity", "target": "endpoint", "content": "SELECT device_hostname, reg_target, reg_value_data, time FROM hb_registry_activity WHERE LOWER(reg_target) LIKE '%\\\\currentversion\\\\run\\\\updatemonitor' AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A registry value named UpdateMonitor pointing to a suspicious binary.", "verified": "dry-run", "verified_at": "2026-10-24" } }, { "id": "triage-early-access", "type": "analytic", "label": "Triage early access markers", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "scoping-pdfopentask", "phishing-script-blocks", "matchwok-registry-persistence" ], "objective": "Determine which hosts show confirmed signs of the UAC-0099 initial access chain (pdfopentask, temporarydoc, or UpdateMonitor).", "description": "Evaluate the scoping and parallel results to confirm an active MATCHWOK infection per host.", "max_iterations": 3, "expected_signal": "A verdict per host indicating if the initial access chain is present.", "success_criteria": "A per-host verdict of malicious | suspicious | benign citing rows from the scoped results." }, "parents": [ { "id": "phishing-script-blocks", "kind": "merge" }, { "id": "matchwok-registry-persistence", "kind": "merge" } ] }, { "id": "mythic-binary-execution", "type": "query", "label": "MythicRatatoskr binary execution", "config": { "dsl": "sqlite", "role": "triage", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%\\\\updater.exe' OR LOWER(process_name) LIKE '%\\\\krbtman.exe' OR LOWER(process_name) LIKE '%\\\\windowsdefendersvc.exe' OR LOWER(process_name) LIKE '%\\\\onedriveliveupdater.exe' OR LOWER(process_name) LIKE '%\\\\applicationasphost.exe' OR LOWER(process_name) LIKE '%\\\\act64.exe' OR LOWER(process_name) LIKE '%\\\\ieupdate.exe' OR LOWER(process_name) LIKE '%\\\\ie.exe' OR LOWER(process_cmd_line) LIKE '%ieupdate%' OR instr(',' || '{{mythic_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Identify the execution of specific filenames and service names associated with the MythicRatatoskr backdoor.", "expected_signal": "Execution of updater.exe, krbtman.exe, or other reported binaries, particularly on hosts from the scoping phase. Suffix matching identifies binaries even when installed in unusual paths." }, "parents": [ { "id": "triage-early-access" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "MythicRatatoskr binary execution", "reads": [ "device_hostname", "process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%\\\\updater.exe' OR LOWER(process_name) LIKE '%\\\\krbtman.exe' OR LOWER(process_name) LIKE '%\\\\windowsdefendersvc.exe' OR LOWER(process_name) LIKE '%\\\\onedriveliveupdater.exe' OR LOWER(process_name) LIKE '%\\\\applicationasphost.exe' OR LOWER(process_name) LIKE '%\\\\act64.exe' OR LOWER(process_name) LIKE '%\\\\ieupdate.exe' OR LOWER(process_name) LIKE '%\\\\ie.exe' OR LOWER(process_cmd_line) LIKE '%ieupdate%' OR instr(',' || '{{mythic_binaries}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Execution of updater.exe, krbtman.exe, or other reported binaries, particularly on hosts from the scoping phase. Suffix matching identifies binaries even when installed in unusual paths.", "verified": "dry-run", "verified_at": "2026-10-24" } }, { "id": "yggdrasil-traffic-baseline", "type": "query", "label": "Baseline rare Yggdrasil mesh traffic", "config": { "dsl": "sqlite", "role": "baseline", "source": "network", "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_ip >= '0200:' AND dst_endpoint_ip < '0400:') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 3", "surface": "hb_network_connection", "description": "Find rare IPv6 traffic in the 200::/7 range indicating mesh-network C2.", "expected_signal": "Connections to IPv6 addresses in the deprecated mesh range (0200:: to 03ff::), appearing on a small number of hosts." }, "parents": [ { "id": "triage-early-access" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Baseline rare Yggdrasil mesh traffic", "reads": [ "dst_endpoint_ip", "device_hostname", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT dst_endpoint_ip, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_network_connection WHERE (dst_endpoint_ip >= '0200:' AND dst_endpoint_ip < '0400:') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY dst_endpoint_ip HAVING host_count <= 3", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Connections to IPv6 addresses in the deprecated mesh range (0200:: to 03ff::), appearing on a small number of hosts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "dst_endpoint_ip" ], "rare_below": 3 }, "verified_at": "2026-10-24" } }, { "id": "full-chain-assessment", "type": "analytic", "label": "Assess full intrusion chain", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "triage-early-access", "mythic-binary-execution", "yggdrasil-traffic-baseline" ], "objective": "Confirm if any hosts showing early access markers also demonstrate MythicRatatoskr binary execution or Yggdrasil mesh network traffic.", "description": "Synthesize early access and follow-on mesh C2 telemetry to confirm a complete backdoor deployment.", "max_iterations": 6, "expected_signal": "A comprehensive verdict linking the initial task to the mesh-network C2.", "success_criteria": "A per-host verdict citing the transition from MATCHWOK to MythicRatatoskr." }, "parents": [ { "id": "mythic-binary-execution", "kind": "merge" }, { "id": "yggdrasil-traffic-baseline", "kind": "merge" } ] }, { "id": "compromise-decision", "type": "checkpoint", "label": "Route on compromise confidence", "config": { "fuzzy": true, "judge": "hunter", "question": "the full-chain-assessment verdict is malicious for at least one host showing Yggdrasil network connections or mythic binary execution", "condition": "the full-chain-assessment verdict is malicious for at least one host showing Yggdrasil network connections or mythic binary execution", "blind_spot": "limited-mesh-visibility", "confidence": "high", "description": "Direct hosts with confirmed mesh-network backdoors to immediate isolation.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "full-chain-assessment" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Stop active C2 communication and prevent the transition to the data-wiping phase.", "instructions": "Isolate the host, terminate updater.exe and krbtman.exe processes, and capture the .updatecache configuration file for forensics.", "action_approval": "required" }, "parents": [ { "id": "compromise-decision", "branch": "on_supports" } ] }, { "id": "manual-incident-review", "type": "task", "label": "Forensic review of mesh config", "config": { "assignee": "analyst", "description": "Review captured artifacts to identify the peer addresses and exfiltration scope.", "instructions": "Decrypt and examine the .updatecache files from C:\\Windows\\system32 to find the Yggdrasil peer public keys and C2 endpoints; check SOCKS5 logs for internal lateral movement." }, "parents": [ { "id": "compromise-decision", "branch": "default" }, { "id": "compromise-decision", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out-hunt", "type": "task", "label": "Close out hunt", "config": { "assignee": "analyst", "description": "Document results and recommend detection improvements.", "instructions": "Record whether Yggdrasil traffic was found, the binaries identified, and recommend the UpdateMonitor registry query for promotion to a permanent rule." }, "parents": [ { "id": "compromise-decision", "branch": "on_refutes" }, { "id": "manual-incident-review" } ] } ] }